29 #include <eventlogrpc_c.h> 46 TRACE(
"EVENTLOG_HANDLE_A_bind() called\n");
56 ERR(
"RpcStringBindingCompose returned 0x%x\n",
status);
65 ERR(
"RpcBindingFromStringBinding returned 0x%x\n",
status);
71 ERR(
"RpcStringFree returned 0x%x\n",
status);
84 TRACE(
"EVENTLOG_HANDLE_A_unbind() called\n");
89 ERR(
"RpcBindingFree returned 0x%x\n",
status);
101 TRACE(
"EVENTLOG_HANDLE_W_bind() called\n");
111 ERR(
"RpcStringBindingCompose returned 0x%x\n",
status);
120 ERR(
"RpcBindingFromStringBinding returned 0x%x\n",
status);
126 ERR(
"RpcStringFree returned 0x%x\n",
status);
139 TRACE(
"EVENTLOG_HANDLE_W_unbind() called\n");
144 ERR(
"RpcBindingFree returned 0x%x\n",
status);
159 if (!BackupFileNameA || (BackupFileNameA->Length == 0))
185 TRACE(
"%p, %s\n", hEventLog, lpBackupFileName);
187 if (lpBackupFileName ==
NULL)
227 if (!BackupFileNameU || (BackupFileNameU->Length == 0))
253 if (lpBackupFileName ==
NULL)
313 TRACE(
"%p, %s\n", hEventLog, lpBackupFileName);
315 if (lpBackupFileName ==
NULL)
375 if (lpBackupFileName ==
NULL)
391 if (lpBackupFileName !=
NULL)
431 TRACE(
"%p\n", hEventLog);
477 TRACE(
"%p\n", hEventLog);
553 if (!NumberOfRecords)
575 TRACE(
"%p, %p\n", hEventLog, NumberOfRecords);
602 if (!OldestRecordNumber)
624 TRACE(
"%p, %p\n", hEventLog, OldestRecord);
700 if (!phEventLog || !BackupFileNameA || (BackupFileNameA->Length == 0))
703 if (UNCServerNameA && (UNCServerNameA->Length != 0))
704 pUNCServerName = UNCServerNameA->Buffer;
738 if (lpUNCServerName ==
NULL)
804 if (!phEventLog || !BackupFileNameU || (BackupFileNameU->Length == 0))
807 if (UNCServerNameU && (UNCServerNameU->Length != 0))
808 pUNCServerName = UNCServerNameU->Buffer;
892 if (!phEventLog || !SourceNameA || (SourceNameA->Length == 0))
895 if (UNCServerNameA && (UNCServerNameA->Length != 0))
896 pUNCServerName = UNCServerNameA->Buffer;
926 TRACE(
"%s, %s\n", lpUNCServerName, lpSourceName);
958 if (!phEventLog || !SourceNameU || (SourceNameU->Length == 0))
961 if (UNCServerNameU && (UNCServerNameU->Length != 0))
962 pUNCServerName = UNCServerNameU->Buffer;
1024 if (!
Buffer || !NumberOfBytesRead || !MinNumberOfBytesNeeded)
1046 NumberOfBytesToRead,
1049 MinNumberOfBytesNeeded);
1065 IN DWORD nNumberOfBytesToRead,
1067 OUT DWORD *pnMinNumberOfBytesNeeded)
1071 TRACE(
"%p, %lu, %lu, %p, %lu, %p, %p\n",
1072 hEventLog, dwReadFlags, dwRecordOffset,
lpBuffer,
1073 nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
1079 nNumberOfBytesToRead,
1081 pnMinNumberOfBytesNeeded);
1117 if (!
Buffer || !NumberOfBytesRead || !MinNumberOfBytesNeeded)
1139 NumberOfBytesToRead,
1142 MinNumberOfBytesNeeded);
1158 IN DWORD nNumberOfBytesToRead,
1160 OUT DWORD *pnMinNumberOfBytesNeeded)
1164 TRACE(
"%p, %lu, %lu, %p, %lu, %p, %p\n",
1165 hEventLog, dwReadFlags, dwRecordOffset,
lpBuffer,
1166 nNumberOfBytesToRead, pnBytesRead, pnMinNumberOfBytesNeeded);
1172 nNumberOfBytesToRead,
1174 pnMinNumberOfBytesNeeded);
1197 if (!phEventLog || !SourceNameA || (SourceNameA->Length == 0))
1200 if (UNCServerNameA && (UNCServerNameA->Length != 0))
1201 pUNCServerName = UNCServerNameA->Buffer;
1231 TRACE(
"%s, %s\n", lpUNCServerName, lpSourceName);
1268 if (!phEventLog || !SourceNameU || (SourceNameU->Length == 0))
1271 if (UNCServerNameU && (UNCServerNameU->Length != 0))
1272 pUNCServerName = UNCServerNameU->Buffer;
1391 TRACE(
"%p, %u, %u, %lu, %p, %u, %lu, %p, %p\n",
1392 hEventLog, wType, wCategory, dwEventID, lpUserSid,
1393 wNumStrings, dwDataSize, lpStrings, lpRawData);
1404 for (
i = 0;
i < wNumStrings;
i++)
1428 for (
i = 0;
i < wNumStrings;
i++)
1530 TRACE(
"%p, %u, %u, %lu, %p, %u, %lu, %p, %p\n",
1531 hEventLog, wType, wCategory, dwEventID, lpUserSid,
1532 wNumStrings, dwDataSize, lpStrings, lpRawData);
1543 for (
i = 0;
i < wNumStrings;
i++)
1567 for (
i = 0;
i < wNumStrings;
i++)
NTSTATUS WINAPI ElfrGetLogInformation(IELF_HANDLE LogHandle, ULONG InfoLevel, PBYTE Buffer, ULONG cbBufSize, PULONG pcbBytesNeeded)
BOOL WINAPI SHIM_OBJ_NAME() GetComputerNameA(LPSTR lpBuffer, LPDWORD lpnSize)
#define ERROR_INVALID_PARAMETER
RPC_STATUS WINAPI RpcBindingFromStringBindingW(RPC_WSTR StringBinding, RPC_BINDING_HANDLE *Binding)
HANDLE WINAPI OpenEventLogW(IN LPCWSTR lpUNCServerName, IN LPCWSTR lpSourceName)
NTSTATUS NTAPI ElfCloseEventLog(IN HANDLE hEventLog)
RPC_STATUS WINAPI RpcBindingFree(RPC_BINDING_HANDLE *Binding)
_In_ DWORD _In_ DWORD _Out_ LPDWORD pcbBytesNeeded
NTSTATUS WINAPI ElfrBackupELFA(IELF_HANDLE LogHandle, PRPC_STRING BackupFileName)
NTSTATUS NTAPI ElfClearEventLogFileA(IN HANDLE hEventLog, IN PANSI_STRING BackupFileNameA)
NTSTATUS WINAPI ElfrReadELW(IELF_HANDLE LogHandle, ULONG ReadFlags, ULONG RecordOffset, RULONG NumberOfBytesToRead, PBYTE Buffer, PULONG NumberOfBytesRead, PULONG MinNumberOfBytesNeeded)
NTSTATUS NTAPI ElfReportEventW(IN HANDLE hEventLog, IN USHORT EventType, IN USHORT EventCategory, IN ULONG EventID, IN PSID UserSID, IN USHORT NumStrings, IN ULONG DataSize, IN PUNICODE_STRING *Strings, IN PVOID Data, IN USHORT Flags, IN OUT PULONG RecordNumber, IN OUT PULONG TimeWritten)
RPC_STATUS WINAPI RpcStringFreeW(RPC_WSTR *String)
NTSTATUS NTAPI ElfReadEventLogW(IN HANDLE hEventLog, IN ULONG ReadFlags, IN ULONG RecordOffset, OUT LPVOID Buffer, IN ULONG NumberOfBytesToRead, OUT PULONG NumberOfBytesRead, OUT PULONG MinNumberOfBytesNeeded)
NTSTATUS WINAPI ElfrClearELFA(IELF_HANDLE LogHandle, PRPC_STRING BackupFileName)
#define STATUS_INVALID_PARAMETER
void __RPC_USER EVENTLOG_HANDLE_A_unbind(EVENTLOG_HANDLE_A UNCServerName, handle_t hBinding)
BOOL WINAPI BackupEventLogW(IN HANDLE hEventLog, IN LPCWSTR lpBackupFileName)
RPC_STATUS WINAPI RpcStringBindingComposeA(RPC_CSTR ObjUuid, RPC_CSTR Protseq, RPC_CSTR NetworkAddr, RPC_CSTR Endpoint, RPC_CSTR Options, RPC_CSTR *StringBinding)
NTSTATUS WINAPI ElfrReportEventW(IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, USHORT NumStrings, ULONG DataSize, PRPC_UNICODE_STRING ComputerName, PRPC_SID UserSID, PRPC_UNICODE_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
BOOLEAN NTAPI RtlFreeHeap(IN PVOID HeapHandle, IN ULONG Flags, IN PVOID HeapBase)
BOOL WINAPI GetEventLogInformation(IN HANDLE hEventLog, IN DWORD dwInfoLevel, OUT LPVOID lpBuffer, IN DWORD cbBufSize, OUT LPDWORD pcbBytesNeeded)
NTSTATUS WINAPI ElfrOpenBELW(EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING BackupFileName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
#define ERROR_NOT_ENOUGH_MEMORY
BOOL WINAPI ReadEventLogW(IN HANDLE hEventLog, IN DWORD dwReadFlags, IN DWORD dwRecordOffset, OUT LPVOID lpBuffer, IN DWORD nNumberOfBytesToRead, OUT DWORD *pnBytesRead, OUT DWORD *pnMinNumberOfBytesNeeded)
NTSTATUS WINAPI ElfrDeregisterEventSource(PIELF_HANDLE LogHandle)
NTSTATUS WINAPI ElfrClearELFW(IELF_HANDLE LogHandle, PRPC_UNICODE_STRING BackupFileName)
BOOL WINAPI ReportEventA(IN HANDLE hEventLog, IN WORD wType, IN WORD wCategory, IN DWORD dwEventID, IN PSID lpUserSid, IN WORD wNumStrings, IN DWORD dwDataSize, IN LPCSTR *lpStrings, IN LPVOID lpRawData)
BOOL WINAPI GetComputerNameW(LPWSTR lpBuffer, LPDWORD lpnSize)
unsigned short * RPC_WSTR
NTSTATUS NTAPI ElfNumberOfRecords(IN HANDLE hEventLog, OUT PULONG NumberOfRecords)
RPC_STATUS WINAPI RpcStringFreeA(RPC_CSTR *String)
RPC_STATUS WINAPI RpcStringBindingComposeW(RPC_WSTR ObjUuid, RPC_WSTR Protseq, RPC_WSTR NetworkAddr, RPC_WSTR Endpoint, RPC_WSTR Options, RPC_WSTR *StringBinding)
NTSTATUS WINAPI ElfrOpenBELA(EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING BackupFileName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
#define EVENTLOG_BACKWARDS_READ
NTSYSAPI VOID NTAPI RtlInitAnsiString(PANSI_STRING DestinationString, PCSZ SourceString)
NTSTATUS WINAPI ElfrBackupELFW(IELF_HANDLE LogHandle, PRPC_UNICODE_STRING BackupFileName)
NTSTATUS NTAPI ElfOpenBackupEventLogW(IN PUNICODE_STRING UNCServerNameU, IN PUNICODE_STRING BackupFileNameU, OUT PHANDLE phEventLog)
NTSTATUS NTAPI ElfRegisterEventSourceW(IN PUNICODE_STRING UNCServerNameU, IN PUNICODE_STRING SourceNameU, OUT PHANDLE phEventLog)
BOOL WINAPI ClearEventLogA(IN HANDLE hEventLog, IN LPCSTR lpBackupFileName)
NTSYSAPI ULONG WINAPI RtlNtStatusToDosError(NTSTATUS)
NTSTATUS NTAPI ElfReportEventAndSourceW(IN HANDLE hEventLog, IN ULONG Time, IN PUNICODE_STRING ComputerName, IN USHORT EventType, IN USHORT EventCategory, IN ULONG EventID, IN PSID UserSID, IN PUNICODE_STRING SourceName, IN USHORT NumStrings, IN ULONG DataSize, IN PUNICODE_STRING *Strings, IN PVOID Data, IN USHORT Flags, IN OUT PULONG RecordNumber, IN OUT PULONG TimeWritten)
NTSTATUS(* NTAPI)(IN PFILE_FULL_EA_INFORMATION EaBuffer, IN ULONG EaLength, OUT PULONG ErrorOffset)
BOOL WINAPI GetOldestEventLogRecord(IN HANDLE hEventLog, OUT PDWORD OldestRecord)
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT NumStrings
NTSTATUS WINAPI ElfrCloseEL(PIELF_HANDLE LogHandle)
static RPC_STRING EmptyStringA
static TAGREF LPCWSTR LPDWORD LPVOID lpBuffer
NTSTATUS WINAPI ElfrRegisterEventSourceW(EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING ModuleName, PRPC_UNICODE_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
handle_t __RPC_USER EVENTLOG_HANDLE_W_bind(EVENTLOG_HANDLE_W UNCServerName)
HANDLE WINAPI OpenBackupEventLogW(IN LPCWSTR lpUNCServerName, IN LPCWSTR lpFileName)
WINE_DEFAULT_DEBUG_CHANNEL(advapi)
NTSTATUS WINAPI ElfrOpenELA(EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING ModuleName, PRPC_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSTATUS NTAPI ElfFlushEventLog(IN HANDLE hEventLog)
NTSTATUS WINAPI ElfrChangeNotify(IELF_HANDLE LogHandle, RPC_CLIENT_ID ClientId, ULONG Event)
NTSTATUS NTAPI ElfOpenBackupEventLogA(IN PANSI_STRING UNCServerNameA, IN PANSI_STRING BackupFileNameA, OUT PHANDLE phEventLog)
BOOL WINAPI BackupEventLogA(IN HANDLE hEventLog, IN LPCSTR lpBackupFileName)
NTSTATUS NTAPI ElfChangeNotify(IN HANDLE hEventLog, IN HANDLE hEvent)
NTSTATUS NTAPI ElfReadEventLogA(IN HANDLE hEventLog, IN ULONG ReadFlags, IN ULONG RecordOffset, OUT LPVOID Buffer, IN ULONG NumberOfBytesToRead, OUT PULONG NumberOfBytesRead, OUT PULONG MinNumberOfBytesNeeded)
#define RpcExceptionCode()
_Must_inspect_result_ _In_ ULONG Flags
_Out_ PCLIENT_ID ClientId
PVOID WINAPI HeapAlloc(HANDLE, DWORD, SIZE_T)
RPC_STATUS WINAPI RpcBindingFromStringBindingA(RPC_CSTR StringBinding, RPC_BINDING_HANDLE *Binding)
NTSTATUS NTAPI ElfOldestRecord(IN HANDLE hEventLog, OUT PULONG OldestRecordNumber)
#define NT_SUCCESS(StatCode)
NTSTATUS NTAPI ElfDeregisterEventSource(IN HANDLE hEventLog)
#define EXCEPTION_EXECUTE_HANDLER
NTSTATUS WINAPI ElfrOpenELW(EVENTLOG_HANDLE_W UNCServerName, PRPC_UNICODE_STRING ModuleName, PRPC_UNICODE_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
void __RPC_USER EVENTLOG_HANDLE_W_unbind(EVENTLOG_HANDLE_W UNCServerName, handle_t hBinding)
#define EVENTLOG_SEQUENTIAL_READ
BOOL WINAPI NotifyChangeEventLog(IN HANDLE hEventLog, IN HANDLE hEvent)
_In_ DWORD _In_ DWORD cbBufSize
NTSYSAPI VOID NTAPI RtlFreeUnicodeString(PUNICODE_STRING UnicodeString)
static const WCHAR Strings[]
BOOL WINAPI GetNumberOfEventLogRecords(IN HANDLE hEventLog, OUT PDWORD NumberOfRecords)
#define EVENTLOG_FULL_INFO
BOOL WINAPI CloseEventLog(IN HANDLE hEventLog)
BOOL WINAPI ReadEventLogA(IN HANDLE hEventLog, IN DWORD dwReadFlags, IN DWORD dwRecordOffset, OUT LPVOID lpBuffer, IN DWORD nNumberOfBytesToRead, OUT DWORD *pnBytesRead, OUT DWORD *pnMinNumberOfBytesNeeded)
NTSTATUS NTAPI ElfBackupEventLogFileW(IN HANDLE hEventLog, IN PUNICODE_STRING BackupFileNameU)
NTSTATUS NTAPI ElfRegisterEventSourceA(IN PANSI_STRING UNCServerNameA, IN PANSI_STRING SourceNameA, OUT PHANDLE phEventLog)
BOOL WINAPI ReportEventW(IN HANDLE hEventLog, IN WORD wType, IN WORD wCategory, IN DWORD dwEventID, IN PSID lpUserSid, IN WORD wNumStrings, IN DWORD dwDataSize, IN LPCWSTR *lpStrings, IN LPVOID lpRawData)
#define EVENTLOG_SEEK_READ
#define MAX_COMPUTERNAME_LENGTH
struct _FileName FileName
FORCEINLINE struct _TEB * NtCurrentTeb(VOID)
GLsizei GLenum const GLvoid GLsizei GLenum GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLint GLint GLint GLshort GLshort GLshort GLubyte GLubyte GLubyte GLuint GLuint GLuint GLushort GLushort GLushort GLbyte GLbyte GLbyte GLbyte GLdouble GLdouble GLdouble GLdouble GLfloat GLfloat GLfloat GLfloat GLint GLint GLint GLint GLshort GLshort GLshort GLshort GLubyte GLubyte GLubyte GLubyte GLuint GLuint GLuint GLuint GLushort GLushort GLushort GLushort GLboolean const GLdouble const GLfloat const GLint const GLshort const GLbyte const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLdouble const GLfloat const GLfloat const GLint const GLint const GLshort const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort const GLdouble const GLfloat const GLint const GLshort GLenum GLenum GLenum GLfloat GLenum GLint GLenum GLenum GLenum GLfloat GLenum GLenum GLint GLenum GLfloat GLenum GLint GLint GLushort GLenum GLenum GLfloat GLenum GLenum GLint GLfloat const GLubyte GLenum GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLint GLint GLsizei GLsizei GLint GLenum GLenum const GLvoid GLenum GLenum const GLfloat GLenum GLenum const GLint GLenum GLenum const GLdouble GLenum GLenum const GLfloat GLenum GLenum const GLint GLsizei GLuint GLfloat GLuint GLbitfield GLfloat GLint GLuint GLboolean GLenum GLfloat GLenum GLbitfield GLenum GLfloat GLfloat GLint GLint const GLfloat GLenum GLfloat GLfloat GLint GLint GLfloat GLfloat GLint GLint const GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat GLint GLfloat GLfloat const GLdouble const GLfloat const GLdouble const GLfloat GLint i
static RPC_UNICODE_STRING EmptyStringU
BOOL WINAPI ClearEventLogW(IN HANDLE hEventLog, IN LPCWSTR lpBackupFileName)
NTSYSAPI NTSTATUS NTAPI RtlAnsiStringToUnicodeString(PUNICODE_STRING DestinationString, PANSI_STRING SourceString, BOOLEAN AllocateDestinationString)
BOOLEAN NTAPI RtlTimeToSecondsSince1970(PLARGE_INTEGER Time, PULONG ElapsedSeconds)
NTSTATUS WINAPI ElfrReadELA(IELF_HANDLE LogHandle, ULONG ReadFlags, ULONG RecordOffset, RULONG NumberOfBytesToRead, PBYTE Buffer, PULONG NumberOfBytesRead, PULONG MinNumberOfBytesNeeded)
NTSTATUS NTAPI ElfReportEventA(IN HANDLE hEventLog, IN USHORT EventType, IN USHORT EventCategory, IN ULONG EventID, IN PSID UserSID, IN USHORT NumStrings, IN ULONG DataSize, IN PANSI_STRING *Strings, IN PVOID Data, IN USHORT Flags, IN OUT PULONG RecordNumber, IN OUT PULONG TimeWritten)
BOOL WINAPI DeregisterEventSource(IN HANDLE hEventLog)
#define EVENTLOG_FORWARDS_READ
NTSTATUS NTAPI ElfOpenEventLogW(IN PUNICODE_STRING UNCServerNameU, IN PUNICODE_STRING SourceNameU, OUT PHANDLE phEventLog)
NTSTATUS WINAPI ElfrFlushEL(IELF_HANDLE LogHandle)
HANDLE WINAPI OpenEventLogA(IN LPCSTR lpUNCServerName, IN LPCSTR lpSourceName)
NTSTATUS WINAPI ElfrReportEventA(IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, USHORT NumStrings, ULONG DataSize, PRPC_STRING ComputerName, PRPC_SID UserSID, PRPC_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
NTSTATUS NTAPI ElfOpenEventLogA(IN PANSI_STRING UNCServerNameA, IN PANSI_STRING SourceNameA, OUT PHANDLE phEventLog)
NTSTATUS WINAPI ElfrRegisterEventSourceA(EVENTLOG_HANDLE_A UNCServerName, PRPC_STRING ModuleName, PRPC_STRING RegModuleName, ULONG MajorVersion, ULONG MinorVersion, PIELF_HANDLE LogHandle)
NTSYSAPI VOID NTAPI RtlInitUnicodeString(PUNICODE_STRING DestinationString, PCWSTR SourceString)
NTSTATUS NTAPI NtQuerySystemTime(OUT PLARGE_INTEGER SystemTime)
_In_ ACCESS_MASK _In_opt_ POBJECT_ATTRIBUTES _In_ EVENT_TYPE EventType
HANDLE WINAPI OpenBackupEventLogA(IN LPCSTR lpUNCServerName, IN LPCSTR lpFileName)
NTSTATUS NTAPI ElfClearEventLogFileW(IN HANDLE hEventLog, IN PUNICODE_STRING BackupFileNameU)
#define ERROR_INVALID_LEVEL
_In_ UINT _Out_ PNDIS_HANDLE LogHandle
NTSTATUS WINAPI ElfrNumberOfRecords(IELF_HANDLE LogHandle, PULONG NumberOfRecords)
HANDLE WINAPI RegisterEventSourceW(IN LPCWSTR lpUNCServerName, IN LPCWSTR lpSourceName)
static SERVICE_STATUS status
static const CHAR FileNameA[]
HANDLE WINAPI RegisterEventSourceA(IN LPCSTR lpUNCServerName, IN LPCSTR lpSourceName)
#define HeapFree(x, y, z)
_In_ NDIS_STATUS _In_ ULONG _In_ USHORT _In_opt_ PVOID _In_ ULONG DataSize
PSDBQUERYRESULT_VISTA PVOID DWORD * dwSize
static PLARGE_INTEGER Time
handle_t __RPC_USER EVENTLOG_HANDLE_A_bind(EVENTLOG_HANDLE_A UNCServerName)
NTSTATUS WINAPI ElfrReportEventAndSourceW(IELF_HANDLE LogHandle, ULONG Time, USHORT EventType, USHORT EventCategory, ULONG EventID, PRPC_UNICODE_STRING SourceName, USHORT NumStrings, ULONG DataSize, PRPC_UNICODE_STRING ComputerName, PRPC_SID UserSID, PRPC_UNICODE_STRING Strings[], PBYTE Data, USHORT Flags, PULONG RecordNumber, PULONG TimeWritten)
NTSYSAPI BOOLEAN NTAPI RtlDosPathNameToNtPathName_U(_In_opt_z_ PCWSTR DosPathName, _Out_ PUNICODE_STRING NtPathName, _Out_opt_ PCWSTR *NtFileNamePart, _Out_opt_ PRTL_RELATIVE_NAME_U DirectoryInfo)
NTSTATUS NTAPI ElfBackupEventLogFileA(IN HANDLE hEventLog, IN PANSI_STRING BackupFileNameA)
NTSTATUS WINAPI ElfrOldestRecord(IELF_HANDLE LogHandle, PULONG OldestRecordNumber)
LONG WINAPI I_RpcMapWin32Status(RPC_STATUS status)